[RFC PATCH] mm/vmalloc: fix vbq->free breakage

[hailong.liu]

From: "hailong.liu" <hailong.liu@xxxxxxxx>

The function xa_for_each() in _vm_unmap_aliases() loops through all
vbs. However, since commit 062eacf57ad9 ("mm: vmalloc: remove a global
vmap_blocks xarray") the vb from xarray may not be on the corresponding
CPU vmap_block_queue. Consequently, purge_fragmented_block() might
use the wrong vbq->lock to protect the free list, leading to vbq->free
breakage.

Signed-off-by: Hailong.Liu <liuhailong@xxxxxxxx>
Reported-by: Guangye Yang <guangye.yang@xxxxxxxxxxxx>
---
 mm/vmalloc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index d12a17fc0c17..869e7788a7d5 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -2269,10 +2269,9 @@ static void _vm_unmap_aliases(unsigned long start, unsigned long end, int flush)
 	for_each_possible_cpu(cpu) {
 		struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, cpu);
 		struct vmap_block *vb;
-		unsigned long idx;

 		rcu_read_lock();
-		xa_for_each(&vbq->vmap_blocks, idx, vb) {
+		list_for_each_entry_rcu(vb, &vbq->free, free_list) {
 			spin_lock(&vb->lock);

 			/*
---
https://lore.kernel.org/all/20240530025144.1570865-1-zhaoyang.huang@xxxxxxxxxx/
BTW, zhangyang also encounter the same issue, maybe revert commit not a
better solution. we need a map to get vbq from vb.
--
2.30.0